Untitled @robertsiciliano1 - Tumblr Blog

FTC Safeguards Rule: Real Estate Businesses Must Check Their Status

The new FTC Safeguards Rule goes into effect on June 9. Everyone in the real estate industry needs to take note of this and evaluate their need for compliance. Failure to comply can result in fines up to $43,972 per day. There is an above-average chance that your real estate business will be subject to these regulations.

Who Is Subject to the FTC Safeguards Rule in Real Estate?

The National Association of Realtors® (NAR) issued a Washington Report update on the Safeguards Rule, outlining who is subject to the new regulations.

You are considered a “financial institution” under the FTC Safeguards rule if–

You maintain customer information for more than 5,000 customers and you provide the following:

Real estate settlement services

Appraisal services (unless you are appraising on a one-time basis and destroying records)

Mortgage services

“Finder” services that match buyers and sellers who negotiate their own transactions

The size of your agency, including number of employees, transactions or annual revenue, has no bearing on Safeguards Rule compliance. If you store records for more than 5,000 customers, you are subject to these regulations.

Two Options for Real Estate Safeguards Rule Compliance

The simplest way for any real estate professional to comply with the Safeguards Rule is to delete old data. If you maintain fewer than 5,000 records, you are not subject to the rule. Note that the regulations apply equally to paper records and digital records and they do not specify the type of customer information that is considered. In other words, if you have a storage unit full of old customer files or a huge email list, that could put you over the limit of 5,000 records, even if you do not have in-depth, digital financial records for all of those customers. Specifically,

Customer information means any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates.

This can create confusion, because some may interpret the rule to mean financial information, while the Safeguards Rule itself has no such limitations. In thinking about whether a particular record contains personal information, ask yourself this question: Could this information, by itself or in combination with information gathered elsewhere, be used to harm a customer? Considered in that context, information as mundane as an email address or phone number qualifies for protection under the Safeguards Rule.

Can you delete or destroy your old records? For most appraisers, agents and brokers in small agencies, this should be possible. Think about the number of transactions you process in a year and the average time you need to hold on to information to complete a transaction. Even if you want to hold on to information for your most valuable clients, you should be able to get under the 5,000-record limit. Be aware that you will need to put a program in place to delete or destroy records on a regular basis to stay under the limit, and that it is prudent to allow some breathing room: You do not want to have 4,998 records if the FTC launches a compliance investigation. It is better to set a cap around 4,000 or fewer, if your business allows.

If you must maintain more than 5,000 records, you must comply with the FTC Safeguards Rule. In general you cannot do this on your own. The regulations require a qualified individual, someone with a professional background in cyber security, to evaluate current security measures, enforce security protocols and verify compliance among all third-party vendors and service providers. The Qualified Individual will also create a written security plan that includes information on how data are stored and retrieved, as well as data destruction protocols and steps to take in case of a cyber attack.

For most real estate businesses, a Virtual CISO can handle the majority of compliance needs. This is an experienced cyber security professional who offers their support as a service at a much lower rate than a full-time cyber security specialist. Larger real estate businesses that process a significant amount of transactions each year, those who build and operate apps or online systems, or those with extensive archives of paper and electronic records, may want to consider a full-time Chief Information Security Officer who can manage the risks of custom software.

Protect Now can help you find a Virtual CISO versed in FTC Safeguards Rule compliance, and provide CE-eligible cyber security training for real esate professionals. If you have questions or concerns about the Safeguards Rule, please contact us online or call us at 1-800-658-8311.

Inactive Account Policy: Don’t Let New Google Rules Lock You Out of Your Site

Google has announced a new Inactive Account Policy that every business owner needs to understand. From their update:

Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents – including content within Google Workspace (Gmail, Docs, Drive, Meet, Calendar) and Google Photos.

The policy only applies to personal Google Accounts, and will not affect accounts for organizations like schools or businesses.

The new inactive account policy is a good idea, but it may come with some significant hidden risks for your website, domain, security certificates and online presence.

How could the Inactive Account Policy harm my business?

As nearly anyone who has worked at an IT firm, digital agency or cyber security business can tell you, some businesses lose their security certificates, hosting or websites because they do not respond to renewal emails. The problem typically begins with a business owner setting up a website using a personal account as the email address, buying services for several years, then forgetting that those services need to be renewed. This happens more frequently than most business owners realize, and it can be devastating if a site host wipes out a business website, or if a business loses access to its domain.

Think about every piece of collateral with your website on it: business cards, letterhead, advertising, online links. Now imagine that all of it is lost because you failed to renew your web address on time. While many online service providers have built recovery options into their renewal processes, those processes may not work if you do not have access to the email used to register the service. At a minimum, you can expect to spend a lot of time on the phone with the provider attempting to resolve the problem. If you lose your web domain, your business email will stop working. These are not problems to take lightly.

How can I stop a lost email address from shutting down my business?

The first step in protecting your online assets is to know what you pay to access to keep your site online. This will always include the following:

Domain Name: This is the URL of your business, such as https://protectnowllc.com. Domains are not owned; businesses purchase access to them for a set period of time from a domain name registrar, such as GoDaddy or Google Domains. Most businesses opt for 2- or 3-year domain registrations, though you can register a domain for longer or for as little as a year.

Site Hosting: Unless you run your own server, someone provides a service to keep your website online. This could be an all-in-one site builder and hosting provider provider, such as Squarespace; a company that specializes in a particular site platform, such as WP Engine, or companies like SiteGround and HostGator that provide server space and allow you to build your site any way you like.

Security Certificates: Your site should have some sort of SSL certificate. Sites that lack them will not be indexed by search engines and may be blocked by web browsers and smart phones.

Third-Party Services: Many things fall into this category, such as image hosts, data feed providers and some website widgets or modules.

Losing access to your domain is the worst case scenario for any business. Sites and email will no longer function.

Most hosting providers have a grace period for renewal. Your site will go offline and your email may stop working, depending on whether your host provides your email as well as your website. Contacting their customer service and updating your agreement with the provider will typically get your site back online quickly. In the worst case scenario, all of your data and site content could be deleted.

These certificates must be renewed annually. You may find it very difficult to access your website if the security certificate expires, but your email will work.

Only specific functions or parts of your website will stop working if one of these services is interrupted.

Make a list of the services you use and the companies that provide them. At a minimum, the list should include your domain name provider, your email provider, your web host and your security certificate provider. If you have trouble identifying any of these providers, look through old emails or review old bank statements and look for one-time charges for companies that may provide these services. You should keep the list of services and providers in a spreadsheet. Do not include passwords in this spreadsheet, as this creates a security risk.

Once you have services and providers listed, log in to each provider and note the date when your service must be renewed. As you attempt to do this, you may discover that a service was registered with a personal email you can no longer access. This is the time to contact the company directly and update your account information. Do not wait until services go down and you are potentially losing business.

Make sure that the email used for each service is active; it can be a personal email, as long as you use that personal email account at least a few times a month. Preferably, it should be a business email associated with a business owner or a company’s IT department. Remember that the new Google Inactive Account Policy will only apply to personal accounts, not Google Workspace or business accounts.

Add the email used to register each service to your spreadsheet. Check the spreadsheet on a regular basis; if you see a renewal date coming up, be sure to check the email associated with that service, including spam folders. Service providers will typically send renewal notices 60 days, 30 days and 14 days before a service is suspended for nonrenewal.

Following these steps will ensure that you do not suffer any service interruptions. In larger organizations, it is a good idea to task someone with service monitoring and renewal so that notices do not slip through the cracks or get overlooked in spam folders. If you contract IT services or have an in-house IT department, make sure that your service providers are whitelisted so that emails can get through.

Why is Google changing its Inactive Account Policy?

Unused email accounts can be used by cyber criminals to carry out attacks, including fake ad attacks that direct users to malware sites. Cyber criminals may also mine unused accounts for personal contacts that can be used in phishing attacks, which is why it is a good idea to be wary of unexpected contacts from people you have not heard from in a long time. An abandoned account may have been compromised, and you could be talking to a criminal.

By suspending these unused accounts, which may have passwords for sale on the Dark Web, Google eliminates an avenue for cyber crime. This is a welcome step for everyone who is concerned with cyber security. Take inventory of your services and the accounts used to access them, and it will have no impact on your business.

Protect Now offers CSI Protection Certification, cyber security employee training that creates meaningful changes in employee attitudes toward individual and business security. We also help businesses manage their overall cyber security with Virtual CISO services. Contact us online or call us at 1-800-658-8311 for a free consultation.

Covid-19 Remote Desktop Has Significant Risks

Are you newly working from home? Or are you an old pro? Either way, it is likely you are using some form of remote desktop protocol. Those of us who have been working home as our primary means of earning a living, know these tools very well and are accustomed to eliminating the various distractions in our home environment in order to get the job done. There are some precautions to be aware of.

None of us think that we are going to get hacked, even though we have seen time and time again that it is very possible. Even the largest companies in existence have been hacked, and small businesses are even more at risk. You can add even more to this risk if you use a software called Remote Desktop.

Basically, Remote Desktop allows you to access computers remotely in your home or office and give network access to employees who are working remotely. However, when you give or have this access, you are opening up your network to hackers. Thousands of companies and individuals have fallen victim to this, and just one successful hack can be devastating to a small business.

Remote Desktop: What is It?

Remote Desktop, or RDP, is a very common software. In fact, if you have Microsoft Windows, you probably have this software and don’t even realize it. Though it is a very powerful tool for businesses, it is also not very secure.

Criminals know this, of course, and they have created a huge variety of tools to hack into this software. When they get access to the network, criminals can access company information and then take things like log-ins and passwords. Once they have this, they can buy and sell them so that other criminals can use them to access your network. Once they are in, they can do almost anything.

Are You at Risk?

There are estimates that there are over three million companies that theoretically have access to Remote Desktop. Most of them are small businesses and many manage their own IT services in house. If you are a small business and you have an in-house IT department, you could definitely fit into this category. What’s more is that hackers tend to target these businesses, too. Any company that has RDP access enabled is a target of hackers.

What Can You Do About It?

Hopefully at this point you are wondering what you can do to protect your business from hackers who like to access networks through RDP.

If you aren’t using remote desktop, then the first thing you should do is to remove Remote Desktop from your network.

Make sure to update your operating systems critical security patches which will inevitably update any software around remote desktop protocol.

Update all software that could allow remote desktop to be vulnerable

Make sure your wireless connections are encrypted which generally means password-protected.

If you have a good reason for keeping it, you can also choose to restrict access by setting up a virtual private network, or VPN.

Additionally, you can create a firewall to restrict its access

Setting up multi-factor authentication is also a good idea if you want to keep this software.

Just be aware that none of these solutions are fool proof except totally deleting the software.

ROBERT SICILIANO CSP, is a #1 Best Selling Amazon author, CEO of CreditParent.com, the architect of the CSI Protection certification; a Cyber Social and Identity Protection security awareness training program.

#online safety online security rdp Remote Desktop Covid-19

It's Tax Time: Play it Safe or Lose Your Identity

Once again, tax time has rolled around, and though you technically have until April 15th, it’s always best to file a bit earlier…especially if you want to avoid setting yourself up for ID theft.

How Could Filing Taxes Compromise Your Identity?

Here’s how you could become a victim of ID theft just by filing your taxes: the first method is that a thief uses your Social Security number to file taxes, and then they steal your refund. The second method that they use is they take your Social Security number, get a job while using your Social Security number, and then their employer reports that income to the IRS. When that happens, the IRS gets your return, flags it as suspicious, and you could get a big tax bill in the process.

Of course, in either case, you could face some big problems. You could, for instance, be unable to file your own tax return or collect your refund…at least for a while until the IRS sorts it out. You also might find that the thief has used your Social Security number to get credit cards, loans, or other cash that will wreck your credit.

How do Thieves Get Your Information?

The big question here is this: how do the ID thieves get your Social Security number in the first place? Generally, they do it by hacking. For instance, do you remember the Equifax hack from 2017? Millions of people were affected, and you, too, could have been involved in that. It’s possible that thieves could get your Social Security info from hacks just like this one.

What to Do if You are a Victim

If you learn that you are a victim of tax ID theft, there are some things that you can do.

Fill out Letter 5071C – This is a form that the IRS sends if it feels like your tax return is suspicious.

Fill out Form 14039 – This form alerts the IRS that you believe you are a victim or potential victim of tax ID or regular ID theft.

Get an Identity Protection PIN – This is a number that the IRS can give you to confirm your identity on any future returns.

Report to the Federal Trade Commission – You should also file a report at IdentityTheft.gov to alert the FTC of the situation.

Contact your state’s tax office – Also, make sure to contact the tax office in your state. It might have other recommendations for you.

If you have tried to e-file and get a rejection, you should still file a paper return via mail. Also, call the IRS Identity Protection Unit for help. An agent can get you started on taking care of the issue and make sure your taxes are filed appropriately.

#Identity Theft #irs #irs scam #social security number

12 Ways To Contain the hack stop the bleeding & eliminating the threat

Hey YOU, SMB, yeah I’m talking to you. There are a number of things that you can do to not only protect your personal information, but also the information you have in your business:

Hire a professional – It is entirely possible the small business was hacked because they did not employ technicians to prevent it in the first place. Therefore 3rd parties that specialize is security and breach mitigation should be contacted immediately. These IT security professionals specialize in containment. Their role will be to forensically determine the nature of the compromise, remove the vulnerability, update any necessary hardware and software, and ensure a breach such as this does not happen in the future.

Disconnecting every affected device from the Internet temporarily – The purpose here is to stop any data from leaving the network and to prevent the hacker from communicating with the server. This may mean disabling internet connections or physically unplugging the internet from connected devices

Change and reset passwords – Many hacks begin with compromised passwords. And the moment a network or device goes back online the hacker will log back in unless all credentials have been changed and updated.

Update all software – Begin by scanning all hardware and software with anti-virus programs and removing viruses. Vulnerabilities are often due to outdated software or operating systems riddled with flaws. Updating with critical patches eliminates these threats. The breached party should have redundant networked hardware systems in place, backed up data, contingency plans to put duplicate systems online immediately in order to maintain operations.

Update your Companies Hardware– Old outdated hardware simply can’t keep up with the requirements of newer robust software or the security software required to keep networks secure.

Back Up All of Your Data – You have to make sure that you are regularly backing up data to a secure location. This data should also be encrypted.

Manage All Identities – You also must make sure that you are managing identities and access to accounts. You must do this across the board, as just one account being accessed could make you or your network extremely vulnerable.

Use Conditional Access – Additionally, you should make sure to use conditional access that is based on factors such as location or device.

Utilize Multi-Factor Authentication – You can use multi-factor authentication to keep accounts protected, too. You can use this on its own, or with other conditional access methods to ensure those who are trying to access your data are legitimate.

Security Awareness Training– Assuming employees know what to do and more importantly, what not do, is risky. Providing effecting ongoing security awareness, and in the authors opinion “security appreciation training” is partnering with employees to protect the network.

Patching – Set up a system so that you can always ensure that your hardware and software is always patched and updated on a regular basis. This helps to keep your data safe.

Align Your IT Security with Other Business Security – Those who are in the IT industry often feel as if they are struggling to keep up with changing technology, including security tech. The success of a business is based on keeping it secure, and by keeping all types of security in mind, including IT security, has a direct impact on revenue.

How to Prevent your Devices From Spying on You

You might not realize it, but your electronic devices may be tracking you. They know what you are doing, what you are reading, and the things you like to do. In almost every case, you give these devices permission to collect this info when you start using them. Here are some tips to help you prevent your devices from spying on you:

Laptops

Macs

If you are using a macOS computer, you can limit the information you are sending to Apple by choosing the Apple menu > System Preferences > Security & Privacy. Click the “Privacy” tab, and then you will see options about what apps can use and share data. If you click “Analytics,” you can do even more. Also, keep in mind that if you install a new app, you have to do those updates, too.

Windows

If you use Windows, you can limit the info you share by going to “Settings,” and then clicking on “Privacy.” You can enable and disable settings for each app. Again, any new apps that you install must be taken care of separately.

Chromebook

Google collects a ton of data, so Chromebook users should pay attention. Got to My Activity, and then delete what you want. You can also turn off some of the data collecting by clicking “Manage your Google Activity,” and then “Go to Activity Controls.”

Phones

You can do similar things to stop data collecting on your phone, too.

iOS

If you have an iPhone, there is a Privacy setting in the Settings menu. Open it, and then click on “Analytics,” to see what you share with Apple. If you don’t want to share this, simply toggle it all off. You can go back to “Privacy,” and then take a look at what the settings are for every app you have downloaded to your phone.

Android

If you have an Android phone, you can choose Google, then go to “Personal Info & Privacy.” Choose the “Activity Controls” screen, and then pick and choose what you want to share. Again, you have to also go to change settings for each app, too.

Fitness Trackers

Your fitness tracker is also spying on you. Apps like Strava and FitBit can be controlled through the Settings and Privacy options on your phone. You can do more, though:

Strava

Click on “Menu,” if you have Android or “More,” if you have iOS. Choose “Settings,” and then “Privacy Controls.”

FitBit

With FitBit, tap your profile, and then your account name. Tap “Personal Stats,” and then “Settings” followed by “Privacy.”

#computer security #Laptop Security #mobile security security #online security #safety & security

How a Wi-Fi Hacker Snoops on Your Laptop and Mobile

You have likely heard of the dangers of using unsecure public Wi-Fi, so you know that hackers are out there snooping. It is pretty easy to hack into a laptop or mobile device that is on a public Wi-Fi connection with no protection. Hackers can read your emails, steal passwords, and even hijack your website log ins.

Let’s imagine that you are in a local coffee shop with your laptop. All someone has to do is download a wireless network analyzer, which usually has a free trial, and with the right hardware and additional software they can often see what everyone is viewing online…unless they are protected. In some cases they can also read your emails that are going out and received, as well as texts you might be sending. Scary, right?

Tips on How to Use a Wi-Fi Hotspot Safely

You now know what you are up against when you connect to a public Wi-Fi spot, but you should also know that you can use them with some safety in mind. Here are some tips:

When you log onto a website, only use an encrypted connection. This means use the URL that begins with HTTPS, not HTTP. Keep an eye on that as you move from page to page because some sites will send you to an unsecured page, which makes you vulnerable.

There are also many websites out there that will allow you to encrypt your browsing session automatically. Facebook, for instance, has this. To turn it on, go to your “Security” settings on the site, and then enable “Secure Browsing.”

If you are going to check your email, login to your web browser and then ensure that your connection to your email client is encrypted. (Check by looking at HTTPS). If you are using Outlook, or another email client, make sure that your settings are set for encryption.

Don’t use any service that is not encrypted when you are on a public Wi-Fi connection.

Consider using a VPN when you are connecting to a public Wi-Fi connection. There is a small fee for this, but it’s well worth it.

Beware of “evil twins” which are rogue networks designed to mimic legitimate networks. Example “ATT WiFi” my be “Free ATT WiFi”. Other than downloading special software that detects evil twins, the best case is to ask someone who’s knowledgeable as to which network is the safest.

If you are on a private network, make sure you realize that they are also vulnerable. Anyone who knows how can spy on the network. Again, use WPA or WPA2 security so the connection is encrypted. However, if someone guesses or knows the password, they can still spy on any device that is connected

#wi-fi #free wi-fi #hacker

Raising a Boy to Be a Man, not a Sex Predator

If you looked at a photo of a baby boy, could you ever predict that he would grow up to become a sexual predator? Probably not. However, a study shows that men who commit sexual crimes are more likely to have something called an “anxious attachment” to their mothers due to feeling rejected as children when wanting attention. As adults, this makes those men unable to create a healthy attachment to women. Research also shows that men who talk to other men known to harass women are even more likely to engage in this behavior.

The big question here is how to prevent our young sons from growing up an becoming predatory men. Psychology tells us that the core of all painful behaviors are two feelings: not feeling worthy and feeling shameful. So, to stop creating predators, we must eliminate these feelings. Here are some things that we can do to start raising boys to be men and not sexual predators:

Change the Meaning of Power

Living in a society where “power” means being better than another person only leads to humiliation and judgement. When we are humiliated, we feel shamed, and that, in turn, raises the odds that a child would become a sexual predator.

Stop Associating Sex and Power

Both men and women are raised, in most cases, to believe that they can stop feeling shame if they are attractive. Women tend to do this with making themselves skinny, often with eating disorders. Men overcome shame by feeling attractive too, but also by being successful. Both genders find affirmation of this through sex, but if a person already feels humiliated, sex can make them feel even less worthy.

Celebrate our Differences

A cultural shift to celebrate our differences, including those between men and women, men and men, women and women, and those who identify as them, their, they would certainly help, too. Many men began to wonder how they could cause their maleness to be appreciated, too. However, we have to learn that we are different in regards to certain things, and to understand that it is totally possible to express differences of tolerance while still celebrating our differences.

Learn to Really Love

We also have to teach children that real empowerment comes from unconditional love. This is love that is given with joy and given without necessarily getting love in return.

Push an Evolution of Society

Research shows that when we live with an attitude of love and compassion, we feel less fear. So, we have to change the way we look at life and connect with our core ability to be loving and compassionate.

OK, so will all of the above solve our sex predator problem? NO. But, there’s definitely something to being more loving, compassionate, and mindful to others. So as my wife always says to me “Just be nice”.

#sex predator

Your Uber Driver May be a Criminal

Do you Uber? If you do, you probably feel pretty safe getting into the car of a stranger. However, you might not be as safe as you think.

Most people take for granted that Uber does background checks on its drivers, but there are actually a number of shady drivers who have recently been accused of crime, and it’s definitely not the first time they have had run ins with law enforcement. Some of these people are accused of committing crimes against their passengers, and that’s where things really get scary.

CNN recently took a look at both Uber and Lyft and found that both companies approved hiring thousands of drivers who have criminal records. Uber responded to this report by saying it knows that there were some hiring mistakes in the past, but they have improved the way they hire, and in 2017, rejected more than 200,000 people because of issues on the background check. However, both companies are not keen to adopt more scrutiny in the screening process.

Several state and local law enforcement agencies are pushing the companies to put more focus on potential drivers. Right now, for instance, they don’t do any fingerprinting nor federal background checks. Instead, both Uber and Lyft use a third-party background check company. It uses the name and Social Security number of potential drivers to check the national sex offender database, local court records, and suspected terrorist databases. The goal is to get drivers on the road as soon as possible, and many of these checks are instant.

Currently, there are 43 states that require screening for rideshare services, but these laws don’t say that the companies have to use a specific company or screen in a certain way. Instead, 42 of these states allow rideshare companies to take responsibility for the screening. Only Massachusetts requires a company background check and an additional check, which is done by the state. Only New York City requires rideshare drivers to have fingerprinting done.

It’s also worth mentioning that just because a company does background checks that include fingerprinting, it isn’t always fool proof. The FBI system that is used for this has incomplete records and it is not meant to be used in this way.

As someone who uses Uber, it’s important that you keep all of this on the back of your mind before you take your next ride. Yes, there is some type of background check done, but don’t let that fool you; your Uber driver could still be a criminal.

#uber #uber driver #uber and lyft #SSN

Quick and Dirty Disaster Prep Guide

How prepared are you for a disaster? Most of us are not prepared, at all, yet two-thirds of us live in an area where we are at a moderate to very high risk of experiencing a natural disaster. Here are a few things you should do, today, to start preparing for a “just in case” situation:

Be Aware

Think about your home and where you live. What disasters are likely to occur? Fire, of course, could happen to any of us, and statistics show that there is a 25% chance that you will experience a major fire in your lifetime. Fires are not the only thing to consider, though. Flooding, winter storms, earthquakes, tornados, and volcanoes are all things that can affect us in the US.

Examine Your Home

In the event of a disaster, do you know where the gas, water, and electric shut-offs are? Are your CO2 and smoke detectors working correctly? Do they have fresh batteries? Do you have fire extinguishers available? Where can you get water? Do you have flashlights and batteries? A first aid kit? A battery-operated radio to get information? All of these things are essential in a disaster situation.

Prepare and Practice

Talk to your family about emergency preparedness. Consider practicing what to do, too, such as in the case of a fire. You might even want to talk to your neighbors about it. Do you have an elderly neighbor or someone who might have extra difficulties during a disaster? Talk to them, too, and help them make a plan.

Other Quick and Dirty Tips for Disaster

Here are some other quick tips for disaster preparedness:

Choose a trusted distant contact. It is often easier to make a long-distance call than a local one in a disaster.

Consider buying a landline phone if you don’t have one. This gives you two options for calls.

Get a waterproof container for documents. Consider laminating these documents or storing them in heavy duty sandwich bags.

Create an Emergency Supply Kit

Finally, create an emergency supply kit including the following:

Water – About a gallon per person, per day, and rotate it every six months

Food – Enough for each person for three days. Try to find food that doesn’t need to be

First Aid Kit – Basic first aid supplies, and any necessary prescription drugs.

Batteries – Have extra batteries available. Generic brands are usually okay, but alkaline batteries tend to be better than non-alkaline.

Knife – Having a multi-tool knife, like a Swiss Army Knife, can be indispensable.

#disaster #home security

Creating an Effective Business Continuity Plan

Most of us have no idea when a disaster is about to strike, and even if we do have a little warning, it’s very possible that things can go very wrong.

This is where you can put a business continuity plan to good use. What does this do? It gives your business the best odds of success during any disaster.

What Exactly is Business Continuity?

Business continuity, or BC, generally refers to the act of maintaining the function of a business as quickly as possible after a disaster. This might be a fire, a flood, or even a cyber-attack. With this plan in place, you can refer to it for specific instructions and procedures that need to be done following these disasters.

Some people believe that a disaster recovery, or DR, plan is the same as a BC plan, but that’s not the case. A DR plan focuses specifically on the IT side of things. In fact, the DR plan is one part of a full BC plan.

Think of your own organization. Do you have a plan in place to get sales up and running immediately? What about HR? Manufacturing? Customer service? If your physical business was leveled in a tornado, how would your CS reps handle calls from customers? If you have no idea, you probably need to think about a BC plan.

Why Having a BC Plan Matters

It doesn’t matter if you have a small business or large corporation, it’s very important that you remain competitive. It is imperative that you keep your current customers while also bringing in new ones…and there is no better test for you than a disaster.

Making sure that your IT capabilities are restored is critical, and there are a number of solutions available. You can certainly rely on your IT team to do this, but what about the rest of the company functions? The future of your company depends on you getting back on track quickly. If not, you can see your value plummet and customer confidence tumble.

Your company can also experience losses. These include financial losses, but also legal losses, and, of course, your company’s reputation.

The Parts of a BC Plan

If your business doesn’t have any type of BC plan in place, you should start by assessing all of your business processes. Take a look at and point out all of the vulnerable areas, and what your losses might be if you lose function in those areas for a day…a couple of days…a week, or even more.

Next, you want to start developing a course of action. There are six steps here, in general, including:

Step #1 – Identify what you need to do with this plan

Step #2 –Choose your key areas to focus on

Step #3 – Pick what functions are critical

Step #4 – Look for dependencies between different areas and functions of your business

Step #5 – Calculate how much downtime is acceptable for all critical functions

Step #6 – Make a plan to keep your company going

One of the best tools that you can have for a BC plan is a checklist that includes all of your equipment and supplies, the location of all of your backups, who should have the plan, and any contact information regarding emergency contacts, important personnel, and backup providers.

Remember, a disaster recovery plan is only one part of the BC plan, so if you don’t have a DR plan, this is a perfect time to do it. If you already have a DR plan, don’t assume that it’s going to work in with your BC plan. You need to make sure that all parts align together.

As you work to create this plan, think about meeting with people who have successfully gone through a disaster with success. They can give you some great insight and valuable information.

You Need to Test Your BC Plan

It is very important that you make sure your plan works before a disaster strikes, and the only way to do that is to test it. The best test, of course, is a real incident, but you can also create a controlled environment and test your plan.

You want to make sure that your BC plan is totally complete and that it will meet your needs in the event of a disaster. You don’t want to take the easy way out, either. Any testing you do should be a challenge for the plan. You also have to make sure that the objectives you have are able to be measured. If you just try to “get away with it,” you will have a weak plan and no success when a disaster strikes.

It is recommended that you test your BC plan a few times a year, especially if there have been any changes, such as a change in key personnel or new equipment. Doing things like walk-throughs and simulations can help everyone on your team practice, and make sure you are all ready should a disaster hit.

Always Review and Improve Your BC Plan

The efforts your put into testing your BC plan cannot be stressed enough. Once that is done, some organizations leave it and focus on other tasks. However, this is when things get stale.

Evolution is happening all of the time with both your personnel and your technology, so it’s imperative that your plan is updated to reflect that. So, you should, at least annually, bring your key personnel together to review the plan and point out any areas that might need modification. You also might want to get some feedback from your staff, too, which you can add to your plan. If you have different branches, make sure to include them in this, too.

Ensuring Your BC Plan is Supported

Having a casual attitude towards your BC plan is a sure-fire way to have it fail. Every BC plan must have the support of all staff from the CEO on down. Senior management, especially, must take a role in supporting the plan, as they can delegate to their teams. Additionally, the plan has better odds of staying fresh in the mid of everyone when it is a priority for management.

Finally, it is also very important that senior management promotes user awareness of the BC plan. After all, if your staff doesn’t know about it, how can they act during a disaster when every second of action counts? Plan distribution and training can help here, too, so consider some type of HR-led initiative to bring all employees onboard with it. This way, your staff will know how important a plan like this is, plus you make sure that they see it as a credible part of the business.

#online security #online safety

A Guide to How Hackers Hack

You have surely heard of hackers, but do you really know how they work? Hackers are well known for being bad guys, though there are certainly good hackers out there too. Here’s a brief guide to help you understand how a hacker can hack:

Directions for Hacking are Easy to Come By

Hackers don’t have to look far for help, especially if they don’t know much about hacking. First is a well-known website known as Kali Linux. It has a ton of tools available for hackers, and the site features many links to other hacking resources. Of course, people who want to hack often go to YouTube, and there are more than 300,000 videos there that teach people how to hack. There are also thousands of other websites out there with easy to follow hacking instructions, and you can find them in about a minute.

Software is Easy to Find, too

Directions for hacking is one part of it, but there is also software available that makes the job of hacking quite easy. Here are some of the options available:

Cain & Able – This tool helps a hacker intercept traffic on a network, and then can use that information to get passwords, which helps them get into accounts. More than 400,000 people have downloaded this software.

Burp Suite – Hackers use this tool to map out the structure and pages of a website, and then they use the information to attack the site.

John the Ripper – People use this tool for dictionary attacks. Basically, it takes text strings, encrypts them, and then uses the information for an attack.

Angry IP Scanner – This is a free tool that allows the user to scan a network for open ports. Once they find one, they can easily gain access.

Hackers Also Use Hardware

In addition to downloading software for hacking, it’s also possible for hackers to use hardware. One is called Wi-Fi Pineapple, which is a small, portable object that the hacker can use with any hotspot. They use it to find a laptop that is searching for an access point. Once the Pineapple sees an open connection, the hacker can read texts, emails, and see what websites you are viewing.

Protect Yourself from Hacks

There are many things that you can do to protect yourself from hackers. First, make sure you are using an encrypted website, one with HTTPS instead of HTTP in the address. Also, consider using a VPN when browsing. This encrypts your data so a hacker cannot read it. There’s a ton more to do. Go here: https://safr.me/blog/

#hacker #online safety #online security

SIM Swapping: What You Need to Know

Have you heard of SIM swapping? It’s a new trick that hackers are using to get money and mess up your life.

What is SIM Swapping?

So, what is SIM swapping? It’s when a hacker tricks your cell phone company into thinking that you have activated your SIM card on another phone. In other words, the hackers are taking your phone number and then associating it with a different SIM card. If the switch is a success, your device will be deactivated, and all of your phones, texts, data, and more will come to the hacker. This means, of course, that the hacker could get access to any account, including your bank account, and could even totally lock you out of your accounts.

How the SIM Swap Scam is Identified

A hacker doesn’t need your device to do a SIM swap. It can all be done remotely, as long as they can convince your service provider to do it. How do they convince your service provider? They give them information about you, such as your birthday, Social Security number, or account number. They can easily get this information from your mail, email, or account.

So, how do you know if you have been the target of a SIM swap? Generally, it’s when you see weird behavior from your phone, like the inability to send texts or make calls for no reason.

Preventing a SIM Swap

There are a number of things that you can do to prevent a SIM swap. Here are some tips:

Start with your online mobile account –Bad guys accessing your online mobile account can own you easily. Set up two factor and use a hard to crack

Watch for Phishing – Most scammers get the information they need to SIM swap by using phishing emails. These are fake emails that are sent to potential victims, and might have weird links, fake login screens, or other methods for tricking people into giving up their info.

Don’t Share Your Info Online – Another thing to do is to watch what you share online. Scammers can also get information from what people share with others on social media, etc.

Protect Your Accounts – Check all of your accounts for security and consider doing things like setting up two-factor authentication, hard to guess passwords, and think about unlinking your phone from your accounts.

Are You a Victim of a SIM Swap?

If you are a victim of a SIM swap, there are certain things you can do:

Contact law enforcement, your bank, the three credit bureaus, and your cell phone provider.

Change all of your passwords, especially Venmo, PayPal, and any account that is tied to your phone number. Make sure that confirmations are NOT sent to your phone number.

If, for any reason, you cannot log into your account, you should contact customer service of the company ASAP and give them a heads up about what happened.

#sim swap fraud #mobile privacy

Louisiana Woman Tries to Buy a Million Dollar Home with False Document

Have you ever seen a house and thought…I wish I could afford that? Some people actually try it, but let this story be a lesson learned: if you can’t afford the cost of a house, you probably shouldn’t try to buy it.

Pamela Chandler was arrested and now faces forgery charges after she tried to purchase a home with a million-dollar price tag. How did she do it? She used false documents. Chandler, who also goes as Pamela Goldwyn, was arrested by a special Financial Crimes Task Force in Bossier City, LA. She also has several warrants out for her in Texas with crimes including fraud and the exploitation of certain groups of people including children, the elderly or the disabled. She was booked in jail and was not given a bond, as she is a flight risk.

According to court records, Chandler, who lists her age as 47, has a permanent address in Athens, Texas, but also has addresses in Maryland and Louisiana. A local Bossier City realtor reported her to local law officials after she tried to use illegitimate paperwork to buy the home. She claimed to have a trust fund, but the paperwork just didn’t add up. As the task force began to investigate the situation, it was found that she had also altered a letter from a layer to try to convince the realtor that she had enough in this fake trust fund to buy the home. It was also discovered that she had used a number of aliases over the years. It is believed that she uses an alias in a specific area until law enforcement catches on to her scams, and then changes her name and moves to a new area.

Much of the problem here can be blamed on easily obtained fake IDs. The fact is, our existing identification systems are insufficiently secure, and our identifying documents are easily copied. Anyone with a computer, scanner and printer can recreate an ID. Outdated systems exasperate the problem by making it too easy to obtain a real ID at the DMV, with either legitimate or falsified information.

Some of the department of multivehicle new requirements of improving facial recognition include not smiling for your picture or smile as long as you keep your lips together. Other requirements meant to aid the facial recognition software include keeping your head upright (not tilted), not wearing eyeglasses in the photo, not wearing head coverings, and keeping your hair from obscuring your forehead, eyebrows, eyes, or ears.

The fact is, identity theft is a big problem due to a systematic lack of effective identification and is going to continue to be a problem until further notice. In the meantime it is up to you to protect yourself. The best defense from new account fraud is identity theft protection.

#real estate #real estate agent crime

Fake Emails are Becoming a Major Issue for Businesses

You might be surprised to know that more than 3.4 billion fake emails are sent around the globe each day. What does this mean? It means that almost every company out there is vulnerable to cybercrimes in the form of “spoofing” and “phishing.” On top of this, most companies out there have not protected themselves from this type of cyber attack. What’s even more interesting is that the vast majority of these emails are not coming from some foreign land, but they are coming from sources based in the US.

This all sounds pretty dreary, but it’s not all bad. Research is showing that many industries in the US are making strides against these fake emails, though some are working harder than others.

To get the data for this research, companies like Valimail is using data from internal analysis of billions of different email authentication requests. The company also used almost 20 million public records about email to publish its report.

This report shows that email impersonation, which made up 1.2 percent of all emails sent during the first quarter of 2019, is the favorite weapon of cyber criminals to get access to a network. They also try to get access to sensitive information and intellectual property.

Fake emails are a problem, and they are not blocked by cybersecurity defenses that are traditionally used.

These fake emails are one of the biggest sources of cyberattacks. As more businesses recognize email vulnerabilities, organizations should start using authentication technology to protect against fraudulent and untrustworthy senders.

The fact is this: too many cybercriminals are using fake emails to get through these defenses, and better methods to identify senders is needed to make sure that email is more trustworthy both now and in the future.

Protect Yourself

The e-mails usually contain at least one link they want you to click. Hover your mouse to see what the URL is. It may appear legit, but note the “http” part.

Reputable sites for giant businesses, such as Microsoft and PayPal, will have an “https” in their URL. The phishing link’s URL will usually not have the “s.”

A big red flag is if there are typos or poorly constructed sentences, but a phishing e-mail may also have flawless text.

Don’t be fooled by company logos, stock imagery, privacy policies, phone numbers and other formalities in the message field. It’s so easy for a hacker to put these elements in there.

Be leery of warnings or alerts that don’t sound right. Gee, why would your account be “in danger of being suspended”?

#cyber crime #Email #email security #online security

The Smart Parent Guide to Digital Literacy

If you are the parent of a child or teen who uses the internet, here are some stats you need to know:

Stats About Teens and the Internet

Teens think that the internet is mostly private

They also think that they can make the best decisions for their life online

They believe they are safe online and that people are who they say they are

They don’t feel at risk if “friending” perfect strangers

They feel like since they are probably better at understanding technology, they can make better decisions than their parents about what’s best practice for online behavior

These are obviously naïve views of the digital world and if parents don’t fully explain why these views aren’t just wrong, but dangerous, then the parent is setting up their child for failure.

Make sure that you are keeping the lines of communication open with your kids about their internet use. Explain the risks involved and share stories of other teens who have found trouble online.

Internet Rules that Parents Should Consider

It is recommended by experts that parents set up rules for their kids in regards to internet use. Here are some:

Know every password that your kid has and use those passwords to check on their accounts.

Don’t let kids use social media, text friends, or chat online until they are in 9th or 10th grade, and never let kids use apps or sites that allow for anonymous communication.

There is NO reason why your 13 year old needs to be head deep in Snapchat or TikTok. NONE. Nothing good will come from it.

Give your kids a time limit for internet use

Don’t allow your kids to respond to messages from strangers, and never “friend” strangers.

Never give out any personal information, such as address or phone number, online.

Always be respectful and kind to others online; bullying should NEVER be allowed.

Do not allow your children to know your passwords.

Do not allow kids to use have access to their devices at all times. Have family time with no screens. i.e. game night, a walk to the local park, etc.

No phones in the bedroom. Buy laptops, not desktops. Laptops shouldn’t be allowed in the bedroom after homework is done.

No photos should be posted to an internet site without permission of parents.

Always check text messages, chat logs, or any other communication online, and make sure that kids understand that there will be consequences if they delete the messages.

Don’t allow kids to download any apps or software without your permission.

Don’t Make These Mistakes

Don’t give your child a traditional smart phone before 9th You can give them a feature-phone, that you have full access to, however.

Don’t give your child internet access that is unmonitored.

Don’t allow your kids to use the internet in closed rooms or in areas where you can’t see what they are doing.

Don’t allow them to play online games where chat is enabled, as these are common targets for sexual predators.

Just because other families are breaking most of these rules, doesn’t mean your family needs to. Don’t be cattle or sheep. Lead by example.

#child child identity theft child internet safety parents

What is Two-Factor Authentication and How Does it Work?

There are a number of ways that you can protect yourself online, and one of the things you can do is to start using two-factor authentication.

You probably have seen two-factor authentication even if you aren’t sure what it is. For instance, if you do online banking, your bank might text a code to your phone or email when you try to change the password. This is two-factor authentication. It’s basically just an extra step that confirms that you are the account owner. This makes it more difficult for hackers to get into your account, too. Not only do they need a password, they also need access to your smart phone or email account.

These Critical Websites need Two Step Authentication

Most large websites have the option for two-factor authentication. Each company name is linked to their specific instruction. Here’s how to set it up:

Apple ID

You can use two-factor authentication on your iCloud, iPhone or iPad:

Click on “Settings,” “Security,” and then “Turn on two-factor authentication.”

Enter a phone number

Look at your text, enter the code, and you are good to go

Facebook

Log into your Facebook account. Click on “Settings,” “Security and Login.”

Choose “Use two-factor authentication,” and then click “edit.”

Select the method. There are several options including texts, apps, and code generators.

Follow the instructions shown on the screen.

Click “Enable.”

Gmail

You can set up two-factor authentication for Gmail and Google accounts.

Navigate to the Google page for two-step authentication.

Click “Get started.”

Follow on-screen instructions to turn the feature on.

Yahoo

Sign into your account

Click “Account security.”

Look for “two-step verification,” and make sure it’s “on.”

Enter your phone number, and choose text message or phone call

Enter the code, and then click on “Verify.”

Instagram

If you use Instagram, you can also set up two-factor authentication:

Log into your account on Instagram.

Navigate to your profile and choose your operating system.

Scroll down until you see “two-factor authentication.”

Click on “require security code.”

Enter a phone number if one is not there. Click “Next.”

You will get a code to your phone. Enter it, and then click “Next.”

Twitter

If you use Twitter, you can also set up two-factor authentication. However, there are different steps to take depending on how you access the site, either from a laptop or PC, an iPhone, or an Android. You can learn about setting two-factor authentication up by visiting the Help Center.

Here are a few more important sites that require a more in-depth explanation:

Paypal

Ebay

Amazon

#two factor #authentication

Trending Blogs

Recently Viewed Blogs

Untitled